cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3

General

Target

cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
Size

897KB
MD5

f2373f8422e235815d9a6fe7def5b6c4
SHA1

279250ba77d1707fb26c8ba5446d6024ce686661
SHA256

cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3
SHA512

7341f21c148255fc9a574b351a8402346c12194e3210563b8b3b023bc1f7dabe02a39ffd270a67efa540af276d89a5b478c8dc704064cd8c156c0bfed4314ec6
SSDEEP

12288:sqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaiTW:sqDEvCTbMWu7rQYlBQcBiT6rprG8aCW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-817259280-2658881748-983986378-1000\{F889B156-93C1-45B1-8857-618B84A2085C}	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 512	1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe	97
PID 1408 wrote to memory of 512	1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe	97
PID 1408 wrote to memory of 1056	1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe	99
PID 1408 wrote to memory of 1056	1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe	99
PID 1408 wrote to memory of 916	1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe	104
PID 1408 wrote to memory of 916	1408	cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe	104

C:\Users\Admin\AppData\Local\Temp\cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe
"C:\Users\Admin\AppData\Local\Temp\cd0be474a71c9150071dd17f1fe9a6474a4441b8127b80662177cdd27d1dcfe3.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5464 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:1
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5200 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:1
1⤵
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5448 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:1
1⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4852 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:8
1⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5856 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:1
1⤵
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6076 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:1
1⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6296 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:8
1⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=6540 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:8
1⤵
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6388 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:8
1⤵
- Modifies registry class
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6332 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:8
1⤵
PID:5916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads